paperclip-coolify-deployer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to generate or capture a 64-character auth secret and then set it as an environment variable via API calls, and to copy/paste CEO invite URLs (containing tokens), which requires the LLM to handle and output secret values verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill sets the application's git_repository to "https://github.com/paperclipai/paperclip" (SKILL.md:98, SKILL.md:355), which Coolify will fetch at deployment time to build and run the app — remote code fetched from that repo directly executes as the deployed service and is a required runtime dependency.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill files for literal high-entropy credentials. The onboarding example includes an invite URL containing a long, random-looking token (pcp_bootstrap_0db2f2d2bc5610d3acaa3f47c58334607cd84d9f90697532). That token appears to be an actual invite token which would grant CEO/admin access — it is high-entropy and not an obvious placeholder, so it should be treated as a secret.

I ignored other values as non-secrets per the rules:

• BETTER_AUTH_SECRET is shown as the placeholder <64-char-hex> (not an actual key).
• YOUR_SERVER_IP, YOUR_APP_UUID, YOUR_API_KEY-style values are documentation placeholders.
• Shell commands, UIDs (1000:1000), port numbers, and file paths are operational examples, not secrets.
• No API keys, private keys, or other literal high-entropy credentials were present besides the invite token.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running privileged host-level commands (e.g., "sudo chown -R 1000:1000 ..." and chmod) and suggests executing commands on the server (via SSH/Coolify terminal), which requires elevated privileges and modifies the host filesystem, so it pushes the agent to change machine state.